On Tue, 22 Sept 2026 at 10:14, Fan Wu <[email protected]> wrote:
>
> The vring size was read after virtio_fs_find_instance() had dropped
> virtio_fs_mutex, so a concurrent virtio_fs_remove() could free the
> virtqueue first. The reference from the lookup keeps the virtio_fs
> alive, but not its virtqueues.
>
> Hold the mutex across the lookup and the read.

Applied, thanks.

Miklos

Reply via email to